CVE-2025-32909

What it actually does

NULL pointer dereference in the sniff_mp4 function of SoupContentSniffer triggered by specially crafted MP4 content delivered over HTTP, causing the client process to crash.

Why it matters to the business

Service interruption for applications that fetch or process remote media streams, leading to client instability and potential downtime in media playback or streaming workflows; widespread use of the affected packages increases exposure across Red Hat enterprise deployments.

How an attack unfolds

An attacker hosts an HTTP server that responds to client requests with MP4 content crafted to reach the vulnerable sniff_mp4 path; when the libsoup-based client processes the response the NULL dereference occurs and the process terminates.

How to fix it

Upgrade gstreamer1-plugins-good and related debug packages on Red Hat Enterprise Linux 8.4 AUS, E4S, and TUS to version 0:1.16.1-3.el8_4 or later in the respective appstream repositories.

How to confirm the fix worked

Verify installed package versions match or exceed the fixed releases listed for each Red Hat variant; confirm the sniff_mp4 code path no longer contains the dereference condition via source review or updated package manifests.

Typical attack path

1. Attacker stands up a malicious HTTP server capable of serving MP4 responses
2. Victim client using the vulnerable gstreamer1-plugins-good stack initiates a request to the attacker-controlled endpoint
3. Server returns content that exercises the SoupContentSniffer sniff_mp4 function
4. NULL pointer dereference triggers immediate client crash

How to detect it

Review application and system logs for unexpected crashes of processes linked to gstreamer or libsoup when handling remote HTTP content; correlate with inbound media requests from untrusted sources.

What your security team should do

• Prioritize patching of gstreamer1-plugins-good packages on all RHEL 8.4 AUS/E4S/TUS systems within the next maintenance window
• Monitor upstream libsoup and gstreamer advisories for additional related fixes
• Apply network egress controls or content-type validation where feasible to reduce exposure to untrusted media sources